# Verify Spark driver service account security requirements for spark-submit Security The Spark driver pod uses a Kubernetes service account to access the Kubernetes API server to create and watch executor pods. Driver service account must have appropriate permissions to list, create, edit, patch and delete pods in your cluster. You can verify that you can list these resources by running the following command: ``` kubectl auth can-i list|create|edit|delete|patch pods ``` Verify that you have the necessary permissions by running each command. ``` kubectl auth can-i list pods kubectl auth can-i create pods kubectl auth can-i edit pods kubectl auth can-i delete pods kubectl auth can-i patch pods ``` The following rules apply to this service role: ``` rules: - apiGroups: - "" resources: - pods verbs: - "*" - apiGroups: - "" resources: - services verbs: - "*" - apiGroups: - "" resources: - configmaps verbs: - "*" - apiGroups: - "" resources: - persistentvolumeclaims verbs: - "*" ``` # Setting up IAM roles for service accounts (IRSA) for spark-submit IAM roles for service roles for spark-submit The following sections explain how to set up IAM roles for service accounts (IRSA) to authenticate and authorize Kubernetes service accounts so you can run Spark applications stored in Amazon S3. ## Prerequisites Before trying any of the examples in this documentation, make sure that you have completed the following prerequisites: + [Finished setting up spark-submit](https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/spark-submit-setup.html) + [Created an S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html) and [uploaded](https://docs.aws.amazon.com/AmazonS3/latest/userguide/uploading-an-object-bucket.html) the spark application jar ## Configuring a Kubernetes service account to assume an IAM role Configuring a Kubernetes service account The following steps cover how to configure a Kubernetes service account to assume an AWS Identity and Access Management (IAM) role. After you configure the pods to use the service account, they can then access any AWS service that the role has permissions to access. 1. Create a policy file to allow read-only access to the Amazon S3 object you [uploaded](https://docs.aws.amazon.com/AmazonS3/latest/userguide/uploading-an-object-bucket.html): ``` cat >my-policy.json <", "arn:aws:s3:::/*" ] } ] } EOF ``` 1. Create the IAM policy. ``` aws iam create-policy --policy-name my-policy --policy-document file://my-policy.json ``` 1. Create an IAM role and associate it with a Kubernetes service account for the Spark driver ``` eksctl create iamserviceaccount --name my-spark-driver-sa --namespace spark-operator \ --cluster my-cluster --role-name "my-role" \ --attach-policy-arn arn:aws:iam::111122223333:policy/my-policy --approve ``` 1. Create a YAML file with the required [permissions](https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/spark-submit-security.html) for the Spark driver service account: ``` cat >spark-rbac.yaml <